CVE-2026-27944CWE-306CWE-311

Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

Critical · published March 5, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
62.9
In the wild
Unconfirmed
What it is

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01014 · 62.9th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-311 · Missing Encryption of Sensitive Data
Published
2026-03-05T16:28Z
EPSS history
Timeline
  • 25 SEP 03:25Z
    EPSS moved 22% → 1%
    epss
  • 05 MAR 16:28Z
    Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
    cvelistv5